Install testssl with Homebrew, dnf, MacPorts, Nix, apt, pacman, zypper

Project links

• Homepage
• Repository

Commands and aliases

• testssl.sh

Project history

The testssl/testssl.sh repository was created in July 2014 and official GitHub releases show a long public release history, including version 2.6 in 2015, 2.8 in 2017, the 3.0 line in 2020 and 2021, and the 3.2 stable line in 2025 and 2026.

The README describes testssl.sh as a no-install-or-configuration tool: no gems, CPAN, pip, or similar runtime stack are needed, and it runs out of the box on Linux, macOS, BSD systems, WSL2, MSYS2, and Cygwin. That packaging profile helped it become a common audit utility in Unix security toolboxes.

The changelog shows the project expanding from cipher and protocol checks into broader TLS operations: STARTTLS support, JSON and CSV output, browser/client simulations, certificate and CA checks, TLS 1.3, Docker images, GHCR builds, SSL Labs-style ratings, post-quantum and newer cipher handling, and mass-testing improvements.

Adoption history

testssl.sh's adoption pattern is visible in its official README: it lists related frontends, mass scanners, privacy checkers, Nagios and Icinga integrations, GitHub Actions, JSON processors, and a Homebrew package discussion. These are signs of a tool used both interactively by security engineers and as a building block in automated checks.

The batch input also shows broad package-manager coverage: Homebrew, Debian, Ubuntu, Fedora/dnf, MacPorts, Nix, Arch/pacman, and openSUSE/zypper. That matters because TLS scanners are often run from ephemeral audit machines, CI jobs, or administrator laptops where quick package installation is the workflow.

How it is used

The normal interactive use is testssl.sh <hostname>, which performs a default scan of a host or URI. The usage documentation also covers per-protocol cipher checks, vulnerability checks such as Heartbleed, CCS injection, POODLE, FREAK, LOGJAM, DROWN, and ROBOT-related coverage, HTTP header checks, STARTTLS protocols, MX scans, proxy use, and IPv6.

For automation, testssl.sh supports batch input with --file, machine-readable JSON and CSV output, log files, append mode, warning suppression for batch runs, and Docker execution. Those features explain why it appears in package-manager catalogs and CI/security pipelines rather than only in penetration-testing notes.

Why package nerds care

testssl.sh is a package-nerd classic because it is a single command with heavy operational value: install it, point it at a host, and get a broad TLS posture report without setting up a web service or sending results to a third party.

Its Bash implementation and bundled compatibility work put it in the same mental shelf as nmap helper scripts, OpenSSL wrappers, and admin audit tools. Distribution packages make it easy to pin or update across fleets, CI runners, and responder laptops.

Timeline

• 2014: testssl/testssl.sh repository created on GitHub.
• 2015: Version 2.6 released, with mass-testing file option and expanded TLS checks.
• 2017: Version 2.8 released, adding features such as trust-chain checks, JSON and CSV logging, HTTP/2 ALPN checks, and DROWN checks.
• 2020-2021: Version 3.0 line released, adding TLS 1.3 support, better JSON output, Docker support, STARTTLS improvements, and more robustness.
• 2025: Version 3.2.0 released as a stable line.
• 2026: Version 3.2.3 marked latest in official GitHub releases, with 3.3 development snapshots also published.

Related projects

• OpenSSL, LibreSSL, STARTTLS services, SSL Labs-style ratings, Docker and GHCR images, Nagios and Icinga checks, GitHub Actions, mass-scanning wrappers, and TLS vulnerability test suites.

Sources

• https://github.com/testssl/testssl.sh CHANGELOG.md
• https://github.com/testssl/testssl.sh Readme.md
• https://github.com/testssl/testssl.sh repository metadata
• https://github.com/testssl/testssl.sh/wiki/Usage-Documentation
• input.source_facts.package-manager
• official GitHub release list for testssl/testssl.sh